Cloud Access Security Brokers (CASBs), even as part of broader Secure Access Service Edge (SASE) frameworks, only help with a limited, pre-catalogued subset of web applications—typically around 30,000 for the leading vendors. In comparison, there are an estimated 200 million active web applications today. These represent applications that have undergone formal risk assessments with appropriate risk scores generated.

For the vast majority of web applications, security teams face a binary choice: allow or block entirely. This all-or-nothing approach leaves no middle ground for nuanced access control. There’s simply no practical way for enterprises to monitor what’s happening within these uncatalogued web applications or determine whether they should be allowed with restrictions or blocked partially. Administrators must rely on Security SaaS Posture Management (SSPM) risk scoring to make blocking decisions without any real understanding of actual usage patterns or data exchange within their organisation.

Many SaaS Management Platforms (SMPs) claim to address CASB gaps in shadow SaaS identification. Some even provide greater visibility into authentication methods and MFA implementation across SaaS apps. However, SaaS management shouldn’t exist as a standalone function isolated from your broader security infrastructure.

With CASB solutions that integrate into SASE frameworks, security teams benefit from shared data pools that web security gateways also contribute to, providing deeper visibility into data exchanges. In contrast, SMPs introduce yet another product category into enterprise environments with questionable return on investment. Without visibility into exactly how shadow applications are used in practice, there’s no foundation for informed decision-making about allowing or restricting these apps.

Both CASBs and SMPs rely heavily on API integrations to gather critical data points. These are expensive operations limited to applications that support API integrations and the restricted range of actions those APIs expose. They generate tremendous costs while providing incomplete Shadow SaaS management coverage.

Additionally, neither solution adequately addresses today’s expanded shadow IT landscape, which must include browser extensions from official stores and side-loaded/developmental ones. This blind spot leaves organisations vulnerable to risks from seemingly innocuous browser add-ons that can access sensitive data.